From: Michael Palmiotto <mpalmiotto(a)tresys.com>
---
.../checks/audit_rules_logon_modification.xml | 34 +++++++++
.../checks/audit_rules_session_modification.xml | 47 ++++++++++++
.../checks/logwatch_configured_on_logserver.xml | 71 ++++++++++++++++++
.../src/input/checks/rsyslog_messages_captured.xml | 70 ++++++++++++++++++
rhel6/src/input/profiles/common.xml | 27 +++++++
rhel6/src/input/system/auditing.xml | 77 +++++++++++++++++++-
rhel6/src/input/system/logging.xml | 67 +++++++++++++++++
7 files changed, 392 insertions(+), 1 deletions(-)
create mode 100644 rhel6/src/input/checks/audit_rules_logon_modification.xml
create mode 100644 rhel6/src/input/checks/audit_rules_session_modification.xml
create mode 100644 rhel6/src/input/checks/logwatch_configured_on_logserver.xml
create mode 100644 rhel6/src/input/checks/rsyslog_messages_captured.xml
diff --git a/rhel6/src/input/checks/audit_rules_logon_modification.xml
b/rhel6/src/input/checks/audit_rules_logon_modification.xml
new file mode 100644
index 0000000..97d170d
--- /dev/null
+++ b/rhel6/src/input/checks/audit_rules_logon_modification.xml
@@ -0,0 +1,34 @@
+<def-group>
+ <definition class="compliance"
id="audit_rules_logon_modification" version="1">
+ <metadata>
+ <title> Record Attempts to Alter Logon and Logout Events</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id=" CCE-14904-7" source="CCE" />
+ <description> Audit attempted manual edits of files involved in storing logon
events.</description>
+ </metadata>
+ <criteria operator = "AND">
+ <criterion comment="watch on lastlog"
test_ref="test_audit_rules_logon_modification_lastlog" />
+ <criterion comment="watch on faillog"
test_ref="test_audit_rules_logon_modification_faillog" />
+ </criteria>
+ </definition>
+ <ind:textfilecontent54_test check="all" comment="lastlog watch"
id="test_audit_rules_logon_modification_lastlog" version="1">
+ <ind:object object_ref="object_audit_rules_logon_modification_lastlog"
/>
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_audit_rules_logon_modification_lastlog" version="1">
+ <ind:path>/etc/audit</ind:path>
+ <ind:filename>audit.rules</ind:filename>
+ <ind:pattern operation="pattern
match">^\-w[\s]+\/var\/log\/lastlog[\s]+\-p[\s]+wa[\s]+\-k[\s]+logins\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+ <ind:textfilecontent54_test check="all" comment="faillog watch"
id="test_audit_rules_logon_modification_faillog" version="1">
+ <ind:object object_ref="object_audit_rules_logon_modification_faillog"
/>
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_audit_rules_logon_modification_faillog" version="1">
+ <ind:path>/etc/audit</ind:path>
+ <ind:filename>audit.rules</ind:filename>
+ <ind:pattern operation="pattern
match">^\-w[\s]+\/var\/log\/faillog[\s]+\-p[\s]+wa[\s]+\-k[\s]+logins\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/audit_rules_session_modification.xml
b/rhel6/src/input/checks/audit_rules_session_modification.xml
new file mode 100644
index 0000000..22b0cb6
--- /dev/null
+++ b/rhel6/src/input/checks/audit_rules_session_modification.xml
@@ -0,0 +1,47 @@
+<def-group>
+ <definition class="compliance"
id="audit_rules_session_modification" version="1">
+ <metadata>
+ <title></title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="CCE-14679-5" source="CCE" />
+ <description>Ensure that watches are placed on utmp, btmp, and wtmp,
sessions.</description>
+ </metadata>
+ <criteria operator="AND">
+ <criterion comment="watch on wtmp"
test_ref="test_audit_rules_session_modification_wtmp" />
+ <criterion comment="watch on utmp"
test_ref="test_audit_rules_session_modification_utmp" />
+ <criterion comment="watch on btmp"
test_ref="test_audit_rules_session_modification_btmp" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="wtmp session
watch" id="test_audit_rules_session_modification_wtmp"
version="1">
+ <ind:object object_ref="object_audit_rules_session_modification_wtmp"
/>
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_audit_rules_session_modification_wtmp" version="1">
+ <ind:path>/etc/audit</ind:path>
+ <ind:filename>audit.rules</ind:filename>
+ <ind:pattern operation="pattern
match">^\-w[\s]+\/var\/log\/wtmp[\s]+wa[\s]+\-k[\s]+session\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" comment="utmp session
watch" id="test_audit_rules_session_modification_utmp"
version="1">
+ <ind:object object_ref="object_audit_rules_session_modification_utmp"
/>
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_audit_rules_session_modification_utmp" version="1">
+ <ind:path>/etc/audit</ind:path>
+ <ind:filename>audit.rules</ind:filename>
+ <ind:pattern operation="pattern
match">^\-w[\s]+\/var\/log\/utmp[\s]+wa[\s]+\-k[\s]+session\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" comment="btmp session
watch" id="test_audit_rules_session_modification_btmp"
version="1">
+ <ind:object object_ref="object_audit_rules_session_modification_btmp"
/>
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_audit_rules_session_modification_btmp" version="1">
+ <ind:path>/etc/audit</ind:path>
+ <ind:filename>audit.rules</ind:filename>
+ <ind:pattern operation="pattern
match">^\-w[\s]+\/var\/log\/btmp[\s]+wa[\s]+\-k[\s]+session\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/logwatch_configured_on_logserver.xml
b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml
new file mode 100644
index 0000000..2a99b92
--- /dev/null
+++ b/rhel6/src/input/checks/logwatch_configured_on_logserver.xml
@@ -0,0 +1,71 @@
+<def-group>
+ <definition class="compliance"
id="logwatch_configured_on_logserver" version="1">
+ <metadata>
+ <title>Ensure Logwatch Configured on the Central Log Server</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="CCE-4323-2" source="CCE" />
+ <description>Check if logwatch service is enabled and
configured.</description>
+ </metadata>
+ <criteria operator="AND">
+ <criterion comment="hostlimit"
test_ref="test_logwatch_configured_on_logserver_hostlimit" />
+ <criterion comment="splithosts"
test_ref="test_logwatch_configured_on_logserver_splithosts" />
+ <criterion comment="multiemail"
test_ref="test_logwatch_configured_on_logserver_multiemail" />
+ <criterion comment="service"
test_ref="test_logwatch_configured_on_logserver_service" />
+
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all"
check_existence="all_exist" comment="Test HostLimit"
id="test_logwatch_configured_on_logserver_hostlimit" version="1">
+ <ind:object
object_ref="object_logwatch_configured_on_logserver_hostlimit" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_state
id="state_logwatch_configured_on_logserver_hostlimit" version="1">
+ <ind:subexpression operation="equals">no</ind:subexpression>
+ </ind:textfilecontent54_state>
+ <ind:textfilecontent54_object
id="object_logwatch_configured_on_logserver_hostlimit"
version="1">
+ <ind:path>/etc/logwatch/conf</ind:path>
+ <ind:filename>logwatch.conf</ind:filename>
+ <ind:pattern operation="pattern
match">^[\s]HostLimit[\s]*=[\s]*[\w]+\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all"
check_existence="all_exist" comment="Test SplitHosts"
id="test_logwatch_configured_on_logserver_splithosts" version="1">
+ <ind:object
object_ref="object_logwatch_configured_on_logserver_splithosts" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_state
id="state_logwatch_configured_on_logserver_splithosts"
version="1">
+ <ind:subexpression operation="equals">yes</ind:subexpression>
+ </ind:textfilecontent54_state>
+ <ind:textfilecontent54_object
id="object_logwatch_configured_on_logserver_splithosts"
version="1">
+ <ind:path>/etc/logwatch/conf</ind:path>
+ <ind:filename>logwatch.conf</ind:filename>
+ <ind:pattern operation="pattern
match">^[\s]SplitHosts[\s]*=[\s]*[\w]+\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all"
check_existence="all_exist" comment="Test MultiEmail"
id="test_logwatch_configured_on_logserver_multiemail" version="1">
+ <ind:object
object_ref="object_logwatch_configured_on_logserver_multiemail" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_state
id="state_logwatch_configured_on_logserver_multiemail"
version="1">
+ <ind:subexpression operation="equals">no</ind:subexpression>
+ </ind:textfilecontent54_state>
+ <ind:textfilecontent54_object
id="object_logwatch_configured_on_logserver_multiemail"
version="1">
+ <ind:path>/etc/logwatch/conf</ind:path>
+ <ind:filename>logwatch.conf</ind:filename>
+ <ind:pattern operation="pattern
match">^[\s]MultiEmail[\s]*=[\s]*[\w]+\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all"
check_existence="all_exist" comment="Test Service"
id="test_logwatch_configured_on_logserver_service" version="1">
+ <ind:object object_ref="object_logwatch_configured_on_logserver_service"
/>
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_state
id="state_logwatch_configured_on_logserver_service" version="1">
+ <ind:subexpression
operation="equals">-zz-disk_space</ind:subexpression>
+ </ind:textfilecontent54_state>
+ <ind:textfilecontent54_object
id="object_logwatch_configured_on_logserver_service" version="1">
+ <ind:path>/etc/logwatch/conf</ind:path>
+ <ind:filename>logwatch.conf</ind:filename>
+ <ind:pattern operation="pattern
match">^[\s]Service[\s]*=[\s]*\-zz\-disk\_space+\s*$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/checks/rsyslog_messages_captured.xml
b/rhel6/src/input/checks/rsyslog_messages_captured.xml
new file mode 100644
index 0000000..0639653
--- /dev/null
+++ b/rhel6/src/input/checks/rsyslog_messages_captured.xml
@@ -0,0 +1,70 @@
+<def-group>
+ <definition class="compliance" id="rsyslog_messages_captured"
+ version="1">
+ <metadata>
+ <title>Ensure Important Messages are Captured</title>
+ <affected family="unix">
+ <platform>Red Hat Enterprise Linux 6</platform>
+ </affected>
+ <reference ref_id="TODO" source="CCE" />
+ <description>Make sure appropriate lines are in rsyslog.conf.
</description>
+ </metadata>
+ <criteria operator="AND">
+ <criterion comment="messages"
test_ref="test_rsyslog_messages_captured_messages" />
+ <criterion comment="kern.log"
test_ref="test_rsyslog_messages_captured_kern" />
+ <criterion comment="daemon.log"
test_ref="test_rsyslog_messages_captured_daemon" />
+ <criterion comment="syslog"
test_ref="test_rsyslog_messages_captured_syslog" />
+ <criterion comment="unused.log"
test_ref="test_rsyslog_messages_captured_unused" />
+ </criteria>
+ </definition>
+
+ <ind:textfilecontent54_test check="all" comment="messages"
id="test_rsyslog_messages_captured_messages" version="1">
+ <ind:object object_ref="object_rsyslog_messages_captured_messages"
/>
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object
id="object_rsyslog_messages_captured_messages" version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>rsyslog.conf</ind:filename>
+ <ind:pattern operation="pattern
match">^auth\.\*[\s]*\,[\s]*user\.\*[\s]+\/var\/log\/messages$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" comment="kern.log"
id="test_rsyslog_messages_captured_kern" version="1">
+ <ind:object object_ref="object_rsyslog_messages_captured_kern" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_rsyslog_messages_captured_kern"
version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>rsyslog.conf</ind:filename>
+<ind:pattern operation="pattern
match">^kern\.\*[\s]+\/var\/log\/kern\.log$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" comment="daemon.log"
id="test_rsyslog_messages_captured_daemon" version="1">
+ <ind:object object_ref="object_rsyslog_messages_captured_daemon" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_rsyslog_messages_captured_daemon"
version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>rsyslog.conf</ind:filename>
+<ind:pattern operation="pattern
match">^daemon\.\*[\s]+\/var\/log\/daemon\.log$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" comment="syslog"
id="test_rsyslog_messages_captured_syslog" version="1">
+ <ind:object object_ref="object_rsyslog_messages_captured_syslog" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_rsyslog_messages_captured_syslog"
version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>rsyslog.conf</ind:filename>
+ <ind:pattern operation="pattern
match">^syslog\.\*[\s]+\/var\/log\/syslog$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+ <ind:textfilecontent54_test check="all" comment="unused"
id="test_rsyslog_messages_captured_unused" version="1">
+ <ind:object object_ref="object_rsyslog_messages_captured_unused" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="object_rsyslog_messages_captured_unused"
version="1">
+ <ind:path>/etc</ind:path>
+ <ind:filename>rsyslog.conf</ind:filename>
+ <ind:pattern operation="pattern
match">^lpr\,news\,uucp\,local0\,local1\,local2\,local3\,local4\,local5\,local6\.\*[\s]+\/var\/log\/unused\.log$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+</def-group>
diff --git a/rhel6/src/input/profiles/common.xml b/rhel6/src/input/profiles/common.xml
index 20853f5..e426f83 100644
--- a/rhel6/src/input/profiles/common.xml
+++ b/rhel6/src/input/profiles/common.xml
@@ -20,6 +20,17 @@
<select idref="selinux_unlabeled_device_files"
selected="true"/>
<select idref="restrict_root_console_logins" selected="true"/>
<select idref="restrict_serial_port_logins" selected="true"/>
+
+<select idref="verify_wheel_exists" selected="true"/>
+<select idref="verify_sudo_audit_trail" selected="true"/>
+<select idref="verify_libuser_login_defs_import"
selected="true"/>
+<select idref="verify_libuser_login_defs_userdefaults"
selected="true"/>
+<select idref="verify_accounts_disabled_after_expiration"
selected="true"/>
+<select idref="pam_ccreds_removed" selected="true"/>
+<select idref="ensure_dot_files_not_world_writable"
selected="true" />
+<select idref="ensure_no_netrc_files" selected="true" />
+<select idref="login_shell_inactivity_timeout"
selected="true"/>
+
<select idref="no_shelllogin_for_systemaccounts"
selected="true"/>
<select idref="no_empty_passwords" selected="true"/>
<select idref="no_hashes_outside_shadow" selected="true"/>
@@ -76,14 +87,18 @@
<select idref="install_openswan" selected="true"/>
<select idref="package_rsyslog_installed" selected="true"/>
<select idref="enable_rsyslog" selected="true"/>
+<select idref="ensure_rsyslog_messages_captured"
selected="true"/>
<select idref="userowner_rsyslog_files" selected="true"/>
<select idref="groupowner_rsyslog_files" selected="true"/>
<select idref="rsyslog_file_permissions" selected="true"/>
<select idref="rsyslog_send_messages_to_logserver"
selected="true"/>
<!-- <select idref="rsyslog_accept_remote_messages"
selected="true"/> -->
<select idref="ensure_logrotate_activated" selected="true"/>
+<select idref="configure_logwatch_on_logserver"
selected="true"/>
+<select idref="disable_logwatch_for_logserver"
selected="true"/>
<select idref="enable_auditd_service" selected="true"/>
<select idref="enable_auditd_bootloader" selected="true"/>
+<select idref="configure_auditd_data_retention"
selected="true"/>
<select idref="audit_time_rules" selected="true"/>
<select idref="audit_account_changes" selected="true"/>
<select idref="audit_network_modifications" selected="true"/>
@@ -93,6 +108,8 @@
<select idref="audit_privileged_commands" selected="true"/>
<select idref="audit_media_exports" selected="true"/>
<select idref="audit_file_deletions" selected="true"/>
+<select idref="audit_manual_logon_edits" selected="true"/>
+<select idref="audit_manual_session_edits" selected="true"/>
<select idref="audit_sysadmin_actions" selected="true"/>
<select idref="audit_kernel_module_loading" selected="true"/>
<select idref="audit_config_immutable" selected="true"/>
@@ -165,6 +182,16 @@
<select idref="disable_smb_server" selected="true"/>
<select idref="require_smb_client_signing" selected="true"/>
<select idref="require_smb_client_signing_mount.cifs"
selected="true"/>
+<select idref="select_squid_listening_port" selected="true"/>
+<select idref="verify_default_secure_settings"
selected="true"/>
+<select idref="change_default_insecure_settings"
selected="true"/>
+<select idref="configure_authentication" selected="true"/>
+<select idref="access_control_lists" selected="true"/>
+<select idref="configure_icp" selected="true"/>
+<select idref="allow_proxy_server_access" selected="true"/>
+<select idref="forward_logs_to_syslogd" selected="true"/>
+<select idref="run_squid_in_chroot_jail" selected="true"/>
+<select idref="lower_privileges" selected="true"/>
<select idref="disable_squid" selected="true"/>
<select idref="uninstall_squid" selected="true"/>
<select idref="disable_snmpd" selected="true"/>
diff --git a/rhel6/src/input/system/auditing.xml b/rhel6/src/input/system/auditing.xml
index e75754f..1d18eaf 100644
--- a/rhel6/src/input/system/auditing.xml
+++ b/rhel6/src/input/system/auditing.xml
@@ -95,6 +95,51 @@ process during boot.
<ref nist="AU-2" />
</Rule>
+<!--
+<Group id="configure_auditd_data_retention">
+<title> Configure <tt>auditd</tt> Data Retention</title>
+<description>
+<ul>
+
+<li> Determine <i>STOREMB</i>, the amount of audit data (in megabytes)
which should be retained in each log
+file. Edit the file <tt>/etc/audit/auditd.conf</tt>. Add or modify the
following line:</li>
+<pre>max_log_file = <i>STOREMB</i></tt>
+
+<li>Use a dedicated partition (or logical volume) for log files. It is
straightforward to create such a partition
+or logical volume during system installation time. The partition should be larger than
the maximum
+space which <tt>auditd</tt> will ever use, which is the maximum size of each
log file (<tt>max_log_file</tt>) multiplied
+by the number of log files (<tt>num_logs</tt>). Ensure the partition is
mounted on <tt>/var/log/audit</tt>.</li>
+
+<li>If your site requires that the machine be disabled when auditing cannot be
performed, configure <tt>auditd</tt>
+to halt the system when disk space for auditing runs low. Edit
<tt>/etc/audit/auditd.conf</tt>, and add or
+correct the following lines:</li>
+<pre>space_left_action = email
+action_mail_acct = root
+admin_space_left_action = halt</pre>
+</ul>
+The default action to take when the logs reach their maximum size is to rotate the log
files, discarding the
+oldest one. If it is more important to retain all possible auditing information, even if
that opens the possibility
+of running out of space and taking the action defined by
<tt>admin_space_left_action</tt>, add or correct the line:
+<pre>max_log_file_action = keep_logs</pre>
+By default, <tt>auditd</tt> retains 4 log files of size 5Mb apiece. For a
busy system or a system which is thoroughly
+auditing system activity, this is likely to be insuffcient.
+The log file size needed will depend heavily on what types of events are being audited.
First configure auditing
+to log all the events of interest. Then monitor the log size manually for awhile to
determine what file size will
+allow you to keep the required data for the correct time period.
+Using a dedicated partition for <tt>/var/log/audit</tt> prevents the
<tt>auditd</tt> logs from disrupting system functionality if
+they fill, and, more importantly, prevents other activity in <tt>/var</tt>
from filling the partition and stopping the audit
+trail. (The audit logs are size-limited and therefore unlikely to grow without bound
unless configured to do so.)
+Some machines may have requirements that no actions occur which cannot be audited. If
this is the case, then
+<tt>auditd</tt> can be configured to halt the machine if it runs out of
space.
+<b>Note:</b> Since older logs are rotated, configuring
<tt>auditd</tt> this way does not prevent older logs from being rotated
+away before they can be viewed.
+<i>If your system is configured to halt when logging cannot be performed, make sure
this can never
+happen under normal circumstances! Ensure that <tt>/var/log/audit</tt> is on
its own partition, and
+that this partition is larger than the maximum amount of data <tt>auditd</tt>
will retain normally.</i></description>
+<oval id="service_auditd_data_retention_configured" />
+</Group>
+-->
+
<Group id="auditd_configure_rules">
<title>Configure <tt>auditd</tt> Rules for Comprehensive
Auditing</title>
<description>The <tt>auditd</tt> program can perform comprehensive
@@ -171,7 +216,6 @@ to capture events that modify account changes:
<ref nist="AU-2(a)" />
</Rule>
-
<Rule id="audit_network_modifications">
<title>Record Events that Modify the System’s Network Environment</title>
<description>Add the following to <tt>/etc/audit/audit.rules</tt>,
setting
@@ -205,6 +249,37 @@ anything other than administrator action. All changes to MAC policy
should be au
<ref nist="AU-2" />
</Rule>
+<Rule id="audit_manual_logon_edits">
+<title> Record Attempts to Alter Logon and Logout Events</title>
+<description>
+The audit system already collects login info for all users and root. To watch for
attempted manual edits of
+files involved in storing logon events, add the following to
<tt>/etc/audit/audit.rules</tt>:
+<pre>
+-w /var/log/faillog -p wa -k logins
+-w /var/log/lastlog -p wa -k logins
+</pre>
+</description>
+<ident cce="14904-7" />
+<oval id="audit_rules_logon_modification" />
+<ref nist="TODO" />
+</Rule>
+
+
+<Rule id="audit_manual_session_edits">
+<title> Record Attempts to Alter Process and Session Initiation
Information</title>
+<description>
+The audit system already collects process information for all users and root. To watch
for attempted manual
+edits of files involved in storing such process information, add the following to
<tt>/etc/audit/audit.rules</tt>:
+<pre>
+-w /var/run/utmp -p wa -k session
+-w /var/log/btmp -p wa -k session
+-w /var/log/wtmp -p wa -k session
+</pre>
+</description>
+<ident cce="14679-5" />
+<oval id="audit_rules_session_modification" />
+<ref nist="TODO" />
+</Rule>
<Rule id="audit_dac_actions">
<title>Ensure <tt>auditd</tt> Collects Discretionary Access Control
diff --git a/rhel6/src/input/system/logging.xml b/rhel6/src/input/system/logging.xml
index 839484e..fc6b311 100644
--- a/rhel6/src/input/system/logging.xml
+++ b/rhel6/src/input/system/logging.xml
@@ -54,6 +54,25 @@ logging services.
<ref nist="AU-2" />
</Rule>
+<Rule id="ensure_rsyslog_messages_captured">
+<title> Ensure Important Messages are Captured</title>
+<description>
+Edit the file <tt>/etc/rsyslog.conf</tt>. Add or correct whichever of the
following lines are appropriate for your
+environment:
+<pre>
+auth.*,user.*
/var/log/messages
+kern.*
/var/log/kern.log
+daemon.*
/var/log/daemon.log
+syslog.* /var/log/syslog
+lpr,news,uucp,local0,local1,local2,local3,local4,local5,local6.*
/var/log/unused.log
+</pre>
+See the man page <tt>rsyslog.conf(5)</tt> for more information.
+<i>By default,</i> <tt>rsyslog</tt> <i>uses a timestamp
format that Logwatch does not understand. If your en-
+vironment uses Logwatch, edit the file <tt>/etc/rsyslog.conf</tt> and add or
edit the following line:</i>
+<pre>$ ActionFileDefaultTemplate
RSYSLOG_TraditionalFileFormat</pre></description>
+<oval id="rsyslog_messages_captured" />
+</Rule>
+
<Group id="log_file_permissions">
<title>Confirm Existence and Permissions of System Log Files</title>
<description>For each log file LOGFILE referenced in
@@ -297,4 +316,52 @@ if the /var/log partition becomes full.</rationale>
<ref nist="AU-2, AU-9, CM-6" />
</Rule>
</Group>
+
+<Rule id="configure_logwatch_on_logserver">
+<title> Configure Logwatch on the Central Log Server</title>
+<description>
+Is this machine the central log server? If so, edit the file
<tt>/etc/logwatch/conf/logwatch.conf</tt>. Add or
+correct the following lines:
+<pre>
+HostLimit = no
+SplitHosts = yes
+MultiEmail = no
+Service = -zz-disk_space
+</pre>
+Ensure that <tt>logwatch.pl</tt> is run nightly from
<tt>cron</tt>. (This is the default):
+<pre># cd /etc/cron.daily
+# ln -s /usr/share/logwatch/scripts/logwatch.pl 0logwatch
+</pre>
+On a central logserver, you want Logwatch to summarize all syslog entries, including
those which did not originate
+on the logserver itself. The <tt>HostLimit</tt> setting tells Logwatch to
report on all hosts, not just the one on which it
+is running.
+If <tt>SplitHosts</tt> is set, Logwatch will separate entries by hostname.
This makes the report longer but significantly
+more usable. If it is not set, then Logwatch will not report which host generated a given
log entry, and that
+information is almost always necessary. If <tt>MultiEmail</tt> is set, then
each host's information will be sent in a
+separate e-mail message. This is a matter of preference.
+The <tt>Service</tt> directive <tt>-zz-disk_space</tt> tells
Logwatch not to run the <tt>zz-disk_space</tt> report, which reports on
+free disk space. Since all log monitoring is being done on the central logserver, the
disk space listing will always be
+that of the logserver, regardless of which host is being monitored. This is confusing, so
disable that service. Note
+that this does mean that <tt>Logwatch</tt> will not monitor disk usage
information. Many workarounds are possible,
+such as running <tt>df</tt> on each host daily via <tt>cron</tt>
and sending the output to <tt>syslog</tt> so that it will be reported to
+the logserver.</description>
+<ident cce="4323-2" />
+<oval id="logwatch_configured_on_logserver" />
+</Rule>
+
+
+<Rule id="disable_logwatch_for_logserver">
+<title> Disable Logwatch on Clients if a Logserver Exists</title>
+<description>
+Does your site have a central logserver which has been configured to report on logs
received from all systems?
+If so:
+<pre>
+# rm /etc/cron.daily/0logwatch
+</pre>
+If no logserver exists, it will be necessary for each machine to run Logwatch
individually. Using a central
+logserver provides the security and reliability benefits discussed earlier, and also
makes monitoring logs easier
+and less time-intensive for administrators.</description>
+<oval id="logwatch_disabled_for_logserver" />
+</Rule>
</Group>
+
--
1.7.6.4